7.1.5 Cryptographic Suite

A Cryptographic Suite is the SA’s set of methods for data encryption, data authentication, and TEK exchange. A Cryptographic Suite is specified as described in 11.2.14. The Cryptographic Suite shall be one of the ones listed in Table 137.

7.2 PKM protocol

7.2.1 SS authorization and AK exchange overview

SSauthorization, controlled by the Authorization state machine, is the process of

a)the BS authenticating a client SS’s identity

b)the BS providing the authenticated SS with an AK, from which a Key Encryption Key (KEK) and message authentication keys are derived

c)the BS providing the authenticated SS with the identities (i.e., the SAIDs) and properties of primary and static security associations the SS is authorized to obtain keying information for

After achieving initial authorization, an SS periodically seeks reauthorization with the BS; reauthorization is also managed by the SS’s Authorization state machine. An SS must maintain its authorization status with the BS in order to be able to refresh aging TEKs. TEK state machines manage the refreshing of TEKs.

An SS begins authorization by sending an Authentication Information message to its BS. The Authentication Information message contains the SS manufacturer’s X.509 certificate, issued by the manufacturer itself or by an external authority. The Authentication Information message is strictly informative; i.e., the BS may choose to ignore it. However, it does provide a mechanism for a BS to learn the manufacturer certificates of its client SS.

The SS sends an Authorization Request message to its BS immediately after sending the Authentication Information message. This is a request for an AK, as well as for the SAIDs identifying any Static Security SAs the SS is authorized to participate in. The Authorization Request includes

a)a manufacturer-issued X.509 certificate

b)a description of the cryptographic algorithms the requesting SS supports; an SS’s cryptographic capabilities are presented to the BS as a list of cryptographic suite identifiers, each indicating a particular pairing of packet data encryption and packet data authentication algorithms the SS supports

c)the SS’s Basic CID. The Basic CID is the first static CID the BS assigns to an SS during initial ranging—the primary SAID is equal to the Basic CID

In response to an Authorization Request message, a BS validates the requesting SS’s identity, determines the encryption algorithm and protocol support it shares with the SS, activates an AK for the SS, encrypts it with the SS’s public key, and sends it back to the SS in an Authorization Reply message. The authorization reply includes:

a)an AK encrypted with the SS’s public key

b)a 4-bit key sequence number, used to distinguish between successive generations of AKs

c)a key lifetime

d)the identities (i.e., the SAIDs) and properties of the single primary and zero or more static SAs the SS is authorized to obtain keying information for

While the Authorization Reply shall identify Static SAs in addition to the Primary SA whose SAID matches the requesting SS’s Basic CID, the Authorization Reply shall not identify any Dynamic SAs.

The BS, in responding to an SS’s Authorization Request, shall determine whether the requesting SS, whose identity can be verified via the X.509 digital certificate, is authorized for basic unicast services, and what additional statically provisioned services (i.e., Static SAIDs) the SS’s user has subscribed for. Note that the protected services a BS makes available to a client SS can depend upon the particular cryptographic suites SS and BS share support for.

An SS shall periodically refresh its AK by reissuing an Authorization Request to the BS. Reauthorization is identical to authorization with the exception that the SS does not send Authentication Information messages during reauthorization cycles. Subclause 7.2.4’s description of the authorization state machine clearly indicates when Authentication Information messages are sent.

To avoid service interruptions during reauthorization, successive generations of the SS’s AKs have overlapping lifetimes. Both SS and BS shall be able to support up to two simultaneously active AKs during these transition periods. The operation of the Authorization state machine’s Authorization Request scheduling algorithm, combined with the BS’s regimen for updating and using a client SS’s Authorization Keys (see 7.4), ensures that the SS can refresh TEK keying information without interruption over the course of the SS’s reauthorization periods.

7.2.2 TEK exchange overview

Upon achieving authorization, an SS starts a separate TEK state machine for each of the SAIDs identified in the Authorization Reply message. Each TEK state machine operating within the SS is responsible for managing the keying material associated with its respective SAID. TEK state machines periodically send Key Request messages to the BS, requesting a refresh of keying material for their respective SAIDs.

The BS responds to a Key Request with a Key Reply message, containing the BS’s active keying material for a specific SAID.

The TEK in the Key Reply is triple DES (encrypt-decrypt-encrypt or EDE mode) encrypted, using a two-key, triple DES key encryption key (KEK) derived from the AK.

Note that at all times the BS maintains two active sets of keying material per SAID. The lifetimes of the two generations overlap such that each generation becomes active halfway through the life of it predecessor and expires halfway through the life of its successor. A BS includes in its Key Replies both of an SAID’s active generations of keying material.

The Key Reply provides the requesting SS, in addition to the TEK and CBC initialization vector, the remaining lifetime of each of the two sets of keying material. The receiving SS uses these remaining lifetimes to estimate when the BS will invalidate a particular TEK, and therefore when to schedule future Key Requests such that the SS requests and receives new keying material before the BS expires the keying material the SS currently holds.

The operation of the TEK state machine’s Key Request scheduling algorithm, combined with the BS’s regimen for updating and using an SAID’s keying material (see 7.4), ensures that the SS will be able to continually exchange encrypted traffic with the BS.

A TEK state machine remains active as long as

a)the SS is authorized to operate in the BS’s security domain, i.e., it has a valid AK, and

b)the SS is authorized to participate in that particular SA, i.e., the BS continues to provide fresh keying material during rekey cycles.